In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved for HTCCTRLRSVD_SVC and should not be modified to be used for any other services.
Reject such service connection responses.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53185.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53185.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@061b0cb9327b80d7a0f63a33e7c3e2a91a71f142",
"deprecated": false,
"digest": {
"line_hashes": [
"293273364095346111802988517644794881941",
"223319901046427312855155003494314905716",
"174735166031536332397815922277060088676",
"90917577636699015005226800034721721416"
],
"threshold": 0.9
},
"id": "CVE-2023-53185-7fbe8189",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c",
"function": "htc_process_conn_rsp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@061b0cb9327b80d7a0f63a33e7c3e2a91a71f142",
"deprecated": false,
"digest": {
"function_hash": "201572204454150704443359948137006579575",
"length": 934.0
},
"id": "CVE-2023-53185-8fe8edc2",
"signature_type": "Function"
}
]